datafeed_linux_system_process_discovery.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
        "bool": {
            "must": [
              {
                "bool": {
                  "should": [
                    {"term": {"process.name": "ps"}},
                    {"term": {"process.name": "top"}}
                  ]
                }
              }
            ]
        }
    }
}